At&t Intellectual Property I, L.p.

At&t Technical Services Company, Inc.

Anestis Karasaridis

David Hoeflin

Vishwa M Prasad

Patrick Michael Velardo, Jr

Robert Sayko

Xiaowen Mang

Sunil Maloo

Srinandan Hullahalli

Robert Roschewsk

Eric Noel

Richard Hellstern

Rensheng Wang Zhang

Stephen Chou

Douglas M Nortz

Aleksandr Zelezniak

Yaron Koral

Yonatan Aharon Levy

Danielle Liu

Ashley Flavel

Willa Kay Ehrlich

Daniel F Hurley

James Miros

Ashwin Sridharan

Carl Brian Rexroad

Swapna Buccapatnam Tirumala

The disclosed technology is directed towards locating and counting unused nodes, such as free Internet Protocol version 4 (IPv4) address blocks. A hierarchical structure of nodes is created from an origin block to a specified lower level, and the hierarchical structure is processed using mapping and eliminating to locate free nodes. A first node group comprises node(s) in use, a second node group identifies intermediate subnets between the first node of the first node group and the specified origin block, and a third node group identifies any subnets hierarchically below node(s) in use. Unused (free) node count information is obtained based on nodes below the origin block that are not in the first node group, the second node group, or the third node group.

Discovering unused internet protocol version 4 address blocks

A method includes receiving, by a processing system of a user endpoint device, a network cookie directly from an internet service provider who provides a subscriber who is associated with the user endpoint device with connectivity to the internet, storing, by the processing system, the network cookie in a local memory of the user endpoint device, generating, by the processing system, a request to send to the Internet service provider, wherein the request comprises a request for an internet protocol address associated with a uniform resource locator of an internet content provider, attaching, by the processing system, the network cookie to the request, and sending, by the processing system, the request including the network cookie to the Internet service provider.

Trusted system for providing customized content to internet service provider subscribers

Aspects of the subject disclosure may include, for example, determining, an application requirement for a server of a data center geographically separated from a central location. A configuration file adapted for the server according to the application requirement is obtained at the central location and a host processor located at the data center is selected according to the application requirement. A static IP address preassigned to an administrative portion of the selected host processor is identified. The selected host processor is initialized remotely over a wide area network via the administrative port without utilizing any software resources pre-existing at the data center. The initializing configures the selected host processor according to the configuration file to service the application requirement. Other embodiments are disclosed.

System and method for remote configuration of scalable datacenter

A method includes receiving a plurality of requests from a user endpoint device associated with a first internet protocol address, where the user endpoint device is associated with a subscriber of the internet service provider network, and where each request of the plurality of requests comprises a request for a respective internet protocol address associated with a respective uniform resource locator of a respective internet content provider, extracting a pattern from the plurality of requests, using a machine learning technique, generating a network cookie that encodes the pattern, and delivering the network cookie to the user endpoint device for installation on the user endpoint device.

A method may include a processing system having at least one processor obtaining a first plurality of domain name system traffic records, generating an input aggregate vector from the first plurality of domain name system traffic records, where the input aggregate vector comprises a plurality of features derived from the first plurality of domain name system traffic records, and applying an encoder-decoder neural network to the input aggregate vector to generate a reconstructed vector, where the encoder-decoder neural network is trained with a plurality of aggregate vectors generated from a second plurality of domain name system traffic records. In one example, the processing system may then calculate a distance between the input aggregate vector and the reconstructed vector, and apply at least one remedial action associated with the first plurality of domain name system traffic records when the distance is greater than a threshold distance.

Unsupervised encoder-decoder neural network security event detection

A system to control access to domains, servers, or content, among other things. There may be individualized or global policies. Policy servers or other devices may interface with databases, DNS servers, firewalls, programmable virtualized routers, or dynamic host configuration protocol servers, among other devices to dynamically update various policy enforcement elements.

Control access to domains, servers, and content

Systems, methods and computer readable media are provided to control anycast traffic using a software defined network controller. Telemetry and event data is gathered from a plurality of service nodes in the network. The telemetry and event data sent by an event broker to an analytic application with a resource conditions at each of the plurality of service nodes is determined based on the telemetry and event data. Traffic routing change recommendations are provided to a software defined network controller based on resource conditions at each of the plurality of service nodes and a set of predetermined policies.

Method and apparatus to control anycast traffic using a software defined network controller

A processing system having at least one processor may obtain domain name system (DNS) traffic records of a DNS platform, the DNS traffic records associated with a source device having a first status and that is submitting DNS queries, where a first-tier DNS authoritative server of the DNS platform is configured to forward the DNS queries from the source device to at least a first second-tier DNS authoritative server of the DNS platform designated for the first status. The processing system may further detect anomalous DNS traffic records from the DNS traffic records, identify a change of the source device from a first status to a second status, based upon the detecting the anomalous DNS traffic records, and reconfigure the first-tier DNS authoritative server to redirect the DNS queries from the source device to at least a second second-tier DNS authoritative server designated for the second status.

Multi-tiered server architecture to mitigate malicious traffic

A system for diffusing denial-of-service attacks by using virtual machines is disclosed. In particular, the system may receive, from a measurement probe, a network transaction measurement associated with a first node in a network. Based on the network transaction measurement, the system may determine if the network transaction measurement satisfies a threshold measurement value. If the network transaction measurement satisfies the threshold measurement value, the system may determine that an attack is occurring at the first node in the network. The system may then identify one or more nodes that have capacity for handling traffic intended for the first node. Once the one or more nodes are identified, the system may launch virtual machines at the one or more nodes to handle legitimate traffic intended for the first node.

Diffusing denial-of-service attacks by using virtual machines

Concepts and technologies disclosed herein are directed to internet traffic classification via time-frequency analysis. According to one aspect of the concepts and technologies disclosed herein, a security classification scheme can be implemented to identify potentially malicious activities from normal internet traffic. The security classification scheme can exploit the distinctive characteristics of different types of traffic in both frequency domain and time domain to identify four different cases. Due to the separation of different types of traffic, the security classification scheme can lower the false alarm rate and improve network security. The security classification scheme can utilize a recursive discrete Fourier transform ('DFT') implementation to enhance computational efficiency. The security classification scheme can be deployed for real-time network traffic monitoring due to an efficient streaming design and can be effectively used to detect and predict when and where the suspicious activities occur within a monitored network.

Growing community of inventors

Oceanport, NJ, United States of America

Anestis Karasaridis